Japanese IME crashes application with ExecutionEngineException

* .NET Core Version: 3.1.100
* Windows version: 1809
* Does the bug reproduce also in WPF for .NET Framework 4.8?: Yes

**Problem description:**
IME crashes the application if the text changed event handler sets a text that is shorter than the text currently inside the textbox.

**Actual behavior:**
The application crashes with ExecutionEngineException

```
System.ExecutionEngineException
HResult=0x80131506
Message=Exception of type 'System.ExecutionEngineException' was thrown.
```

On Full .Net framework I get a little more of an error message:
```
Managed Debugging Assistant 'FatalExecutionEngineError'
Message=Managed Debugging Assistant 'FatalExecutionEngineError' : 'The runtime has
encountered a fatal error. The address of the error was at 0x5f74a820, on thread 0xfac. The error
code is 0x80131623. This error may be a bug in the CLR or in the unsafe or non-verifiable portions
of user code. Common sources of this bug include user marshaling errors for COM-interop or
PInvoke, which may corrupt the stack.'
```

**Expected behavior:**
No exception should be thrown. The text 'あい' is put into the textbox instead.

**Minimal repro:**
Enable Japanese IME on your system. Run the program from the attached project. Activate Hiragana input mode. Enter 3 characters into the grey text box.

[WpfApp12.zip](https://github.com/dotnet/wpf/files/3973087/WpfApp12.zip)